Binance Second Withdrawal Phase Opens on November 3 After $6.3 Billion Hack

Binance second withdrawal phase began on Tuesday, November 3, 2026, five days after hackers drained about $6.3 billion from the exchange's hot wallets in the largest cryptocurrency theft on record. The exchange said withdrawals for additional assets would reopen progressively from 04:00 UTC, after security and readiness checks. It is the next step in a phased recovery begun on November 1, as outflows slow.

Key Points

• Binance opened a second withdrawal phase on Tuesday, November 3, 2026, from 04:00 UTC, covering nine additional networks.
• The networks are BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base.
• Net outflows slowed to $2.57 billion on Monday, down from $6.1 billion on Sunday, according to DefiLlama data cited by Cointelegraph.
• Binance says about 95% of the stolen tokens have been replaced and more than $6.34 billion in company funds has been set aside.
• The exchange warned that anyone promising faster withdrawals for a fee is running a scam.

What Happened

According to Binance's Security Incident Recovery Update #6, reported by Cointelegraph on November 3, the second phase covers additional assets across nine networks. Services return gradually as checks are completed, rather than switching on all at once. Binance has warned that processing may be delayed during the initial resumption because of high traffic, and it has not given a date for full restoration of every remaining service.

The timing meant customers woke to different stages of the rollout: 04:00 UTC was 9:30 a.m. in India, midday in Beijing and the early hours of the morning in the United States, still before dawn on Election Day. Some assets appeared quickly; others remained unavailable pending their own checks. On Monday, Binance also reopened withdrawals for several fiat currencies, including the US dollar, the United Arab Emirates dirham, the Vietnamese dong, the Philippine peso and the Indonesian rupiah.

Background: The Hack and the First Phase

The crisis began on October 29, when hackers drained about $6.3 billion from Binance's hot wallets. The exchange has described the incident as a vendor-compromise drain and said there is no evidence that wallet private keys leaked. About $3 billion was frozen on-chain afterwards, and Circle froze more than $1.1 billion in USDC linked to the theft. On October 31, the FBI attributed the hack to North Korea's TraderTraitor actors, the first official US government attribution in the case.

The first withdrawal phase began on November 1 across 15 networks, covering bitcoin, ether, USDT, USDC, SOL, XRP and BNB. In its first nine and a half hours, from 06:00 to 15:30 UTC, Binance processed $4.649 billion in withdrawals against $1.01 billion in deposits, a net outflow of about $3.64 billion. Binance put that at about 2.1% of its $171 billion in assets, based on an October 28 proof-of-reserves update, and said the spike then stabilised. DefiLlama figures were higher in some accounts.

Binance Second Withdrawal Phase: What Is Reopening

The second phase broadens access beyond the assets restored on November 1. Within the nine networks, individual tokens return asset by asset, in an order shaped partly by demand over the past week. A customer holding a popular token on one of those networks is therefore more likely to see withdrawals return early than a holder of a thinly traded token on the same network.

Binance has also said about 95% of the stolen tokens have now been replaced, with the least liquid tokens left to cover. It has set aside more than $6.34 billion in company funds, drawing on its SAFU fund, its Futures Insurance Fund and treasury reserves, and it has repeatedly said customers will not bear the financial consequences of the theft. Those figures remain exchange-provided rather than independently verified, as is the October 31 proof-of-reserves update that said major assets were each backed at 100%.

The slowing outflow picture is the clearest sign so far that the first phase did not trigger a run. DefiLlama data cited by Cointelegraph put net outflows at $6.1 billion on Sunday, the first full day after withdrawals resumed, falling to $2.57 billion on Monday. Binance has described total net outflows since reopening as around 3% of platform assets, and analysts cited by Reuters said that figure suggested customer confidence had largely held up.

Reactions and Quotes

Binance's most urgent message on Tuesday was not about networks or numbers, but about scams. In an alert posted on X on November 2, the exchange warned that fraudsters were impersonating Binance representatives through direct messages, emails, group chats and even small transfers carrying a message, offering to speed up withdrawals, give priority processing, help claim compensation or move assets to a so-called Binance vault.

“Anyone promising to expedite it for a fee is scamming you,” Binance warned. The exchange said withdrawals are resuming in phases and that no payment, fee or transfer to a third party can accelerate an individual customer's place in the queue. Market watchers are more cautious: the phased reopening is an operational step, not proof the failure is fully understood or funds will be recovered.

Why It Matters

Binance is the world's largest cryptocurrency exchange by trading volume, so its handling of the largest theft in crypto history sets a precedent for the whole industry. If a phased, transparent reopening can hold, with outflows slowing and reserves holding, other exchanges will study it as a playbook. If it falters, confidence across the sector will suffer. For US customers, the hack and attribution also raise familiar custody and consumer-protection questions.

What Happens Next

The next milestones are easy to watch: whether remaining assets clear their checks without further delays, whether net outflows keep falling or rise again as more tokens become available, and whether further frozen funds are identified or stolen assets recovered. Binance has not said when every service will be fully restored, and customers should treat any date circulating on social media with scepticism unless it comes from the exchange itself.

Frequently Asked Questions

What is Binance's second withdrawal phase? The second stage of restoring withdrawals after the October 29 hack, opening additional assets across nine networks from 04:00 UTC on November 3, 2026, asset by asset, after security checks.

Which networks are included? BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base, with tokens prioritised partly by recent customer demand.

How much money left Binance after reopening? About $3.64 billion net in the first nine and a half hours on November 1. DefiLlama data put Sunday net outflows at $6.1 billion, falling to $2.57 billion on Monday.

Will customers lose money from the hack? Binance says no: it has set aside more than $6.34 billion in company funds and says about 95% of stolen tokens have been replaced, though those figures are not independently verified.

How can customers avoid scams? Ignore anyone offering faster withdrawals, priority processing, compensation claims or a Binance vault for a fee. Binance says anyone promising to expedite withdrawals for a fee is scamming you.

Related coverage: Binance $3.64 billion outflows test trust after record $6.3 billion hack, Binance withdrawals resume in phases as 95% of hack losses now covered, and Binance covers 90% of $6.3 billion hack losses as withdrawals resume.